CI/CD Pipeline Compromise

CriticalDevOps SecurityOWASP DevSecOps Guideline

Attackers gain unauthorized access to CI/CD pipelines, inject malicious code into builds, tamper with deployment configurations, or exfiltrate secrets stored in pipeline environment variables.

Immediate Response

1Immediately revoke all CI/CD tokens, API keys, and service account credentials.
2Halt all active pipelines and deployments until the compromise is investigated.
3Audit pipeline logs to identify unauthorized changes or secret access.
4Isolate affected build agents and runners for forensic analysis.

All playbooks

1Regenerate all secrets and rotate credentials stored in CI/CD systems.
2Implement branch protection rules requiring code review and status checks.
3Enable pipeline execution approval gates for production deployments.
4Deploy pipeline activity monitoring and alerting for suspicious changes.

Long-term Prevention

1Implement signed commits and pipeline configuration integrity verification.
2Use ephemeral, isolated build environments that are destroyed after each run.
3Apply least-privilege access to CI/CD systems with just-in-time credential provisioning.
4Conduct regular security audits of pipeline configurations and access controls.

Attack vectors

Compromised CI/CD credentials or API tokens with write access to pipelines
Malicious pull requests or merge commits that bypass security gates
Poisoned build agents or runners with backdoored tooling
Manipulated pipeline configuration files (.github/workflows, Jenkinsfile, .gitlab-ci.yml)

Indicators of compromise

Unexpected build steps or pipeline stages not in the original configuration
Build artifacts with different checksums than expected
Unauthorized access to pipeline secrets or environment variables
Anomalous pipeline execution times or resource usage

Tooling

GitHub Advanced SecurityGitLab SecureSLSA FrameworkSigstoreBuildPulse